The flaw allows an attacker with a stolen JWT to enroll a malicious TOTP or passkey for a victim’s account without requiring the user’s current password. Because these enrollment endpoints execute outside the normal session security checks, the attacker can create or overwrite the victim’s two‑factor credentials, giving the attacker ongoing access that persists after the victim changes their password. This results in a complete compromise of the victim’s account, potentially exposing confidential data and administrative control.

The vulnerability affects the Nginx UI web interface produced by 0xJacky. All releases before version 2.4.1 are susceptible; version 2.4.1 and later include the fix.

The CVSS score of 8.8 classifies the issue as high severity, and the EPSS score is currently unavailable. The vulnerability is not listed in CISA’s KEV catalog, but the lack of re‑authentication during enrollment makes exploitation straightforward for anyone with a valid session token. An attacker can leverage the exposed endpoints to establish persistent control over a victim’s account without triggering additional authentication prompts.